On 08/06/2013 09:24 AM, Stefan Berger wrote:
iptables version 1.4.16 and later automatically convert -m state --state ... to -m conntrack --ctstate ... In the test cases we will then only see 'ctstate' and convert that back to the older 'state' before comparing actual against expected output.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
---
+probeIptablesCtstate() { + rev=$(iptables --version | \ + sed -n 's/.*v\([[:digit:]].\)/\1/p' | + gawk -F. '{print $1 * 1000000 + $2 * 1000 + $3 }') + # 1.4.16 or later uses ctstate + if [ $rev -ge 1004016 ]; then
Version number probes are inherently fragile. Can you do a feature probe instead, in case someone backports this feature to a build of iptables that reports an earlier version?
+ if [ $IPTABLES_USE_CTSTATE -ne 0 ]; then + #change ctstate tback o state + sed -i "s/ctstate/state/" ${tmpfile}
Do we even need the version/feature probe? What if we just ALWAYS do this substitution? It won't hurt on older iptables (it will just be a no-op). -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org